MAINE SECURITY BREACH REPORTING FORM 

Pursuant to the Notice of Risk to Personal Data Act 

_ (Maine Revised Statutes 10 M.R.S.A. §§ 1346-1350-B) _ 

Name and address of Entity that owns or maintains the computerized data that was subject to the breach: 

Brennan Recupero Cascione Scungio and McAllister LLP _ 

Street Address: 362 Broadway _ 

City: Providence _State: _R|_Zip Code: 02009 _ 


Submitted by: Ryan C. Loughlin _Title: Partner _Dated: 11/22/16 

Firm Name (if other than entity): Mullen Coughlin LLC _ 

Telephone: (267) 930-4786 _Email: rloughlin@mullen.law _ 

Relationship to Entity whose information was compromised: Attorney _ 


Type of Organization (please select one): [ ] Governmental Entity in Maine; [ ] Other Governmental Entity; 
[ ] Educational; [ ] Health Care; [ ] Financial Services; * [X] Other Commercial; [ ] Not-for-Profit 


Number of Persons Affected: 

Total (including Maine residents): 2266 _Maine Residents: _8_ 

If the number of Maine residents exceeds 1,000, have the consumer reporting agencies been notified? [ ] Yes; [ ] No. 


Dates: Breach Occurred: 8/15/2016 _Breach Discovered: 8/15/2016 _Consumer Notification: 11/22/2016 


Description of Breach (please select all that apply): 

[ (Loss or theft of device or media (e.g., computer, laptop, external hard drive, thumb drive, CD, tape); 

[ (Internal system breach; [ (Insider wrongdoing; [X|External system breach (e.g., hacking); [ ]Inadvertent disclosure; 
[ (Other (specify):_ 


Information Acquired: Name or other personal identifier in combination with (please select all that apply): 
[X]Social Security Number 

[ (Driver’s license number or non-driver identification card number 

[ (Financial account number or credit or debit card number, in combination with the security code, access code, 
password, or PIN for the account 


Manner of Notification to Affected Persons - ATTACH A COPY OF THE TEMPLATE OF THE NOTICE TO 
AFFECTED MAINE RESIDENTS: 

[X| Written; [ (Electronic; [ (Telephone; [ ] Substitute notice. 

List dates of any previous (within 12 months) breach notifications:_ 


Identity Theft Protection Service Offered : [X] Yes; [ ] No. 

Duration: i year _ Provider: AllClear ID _ 

Brief Description of Service: credit monitoring and identity restoration services 


*If reporting to Department of Professional and Financial Regulation, this form is not required. 10 
M.R.S.A. § 1348(5) 













PLEASE COMPLETE AND SUBMIT THIS FORM TO 


Fax or E-mail this form to: 

Maine State Attorney General’s Office 

SECURITY BREACH NOTIFICATION 

Consumer Protection Division 

111 Sewall Street, 6 th Floor 

Augusta, Maine 04330 

Fax: 207-624-7730 

E-mail: breach.security@maine.gov 



Exhibit 1 



We represent Brennan Recupero Cascione Scungio and McAllister LLP, 362 Broadway, 
Providence, Rhode Island 02009 (“Brennan Recupero”), and are writing to notify you of a data 
security incident that may affect the security of the personal information of eight (8) Maine 
residents. The investigation into this incident is ongoing and will be supplemented with any new 
significant facts learned subsequent to its submission. By providing this notice, Brennan Recupero 
does not waive any rights or defenses regarding the applicability of Maine law or personal 
jurisdiction. 


Nature of the Cyber Security Incident 

On August 15, 2016, the credentials for a Brennan Recupero attorney were briefly used by an 
unauthorized individual to remotely access its computer network. The unauthorized access was 
quickly discovered and Brennan Recupero immediately reset all user passwords to the network to 
prevent any further access to the network. In addition, Brennan Recupero launched an internal 
investigation and retained third-party forensic experts to determine whether the unauthorized 
individual accessed any data within out network and if so, the extent of that access. Brennan 
Recupero determined that while the unauthorized individual or individuals had access to Brennan 
Recupero’s network, certain personal information was accessible and may have been viewed by 
the unauthorized individual including individuals’ names, Social Security number and address. 

Notice to Maine Residents 

On or around October 10, 2016, Brennan Recupero and its forensic experts completed a review 
of the files accessible to identify those whose information was accessible and the type of 
information related to these individuals that was contained in the accessible files. This review 
process involved both a programmatic and manual review of a variety of different file types to 
identify those who may be impacted. Given the complexity and volume of documents to be 
reviewed, this process took some time once the accessible files were identified. Brennan 
Recupero then moved to provide notice to the identified individuals who may be affected by this 
incident. 

On November 22, 2016, Brennan Recupero began mailing notice letters to potentially affected 
individuals which includes eight (8) Maine residents. The notice will be provided in substantially 
the same form as the letter attached here as Exhibit A. 

Other Steps Taken 

Brennan Recupero is offering potentially affected individuals complimentary access to twelve 
(12) months of free credit monitoring and identity restoration services with AllClear ID. 
Additionally, Brennan Recupero is providing potentially affected individuals with information 
on how to protect against identity theft and fraud, including information on how to contact 
the Federal Trade Commission, the state attorney general, and law enforcement to report any 
attempted or actual identity theft and fraud. In addition to providing notice of this incident to 
you, Brennan Recupero is providing written notice of this incident to other state regulators 
where required. 



Exhibit A 



Brennan, Recupero, Cascione, Scungio & McAllister, LLP 
Attorneys At Law 

Processing Center • P.0. BOX 141578 • Austin, TX 78714 


00259 

Iras* JOHN Q. SAMPLE 
slits 1234 MAIN STREET 
0,234 ANYTOWN US 12345-6789 


November 22, 2016 


RE: Notice of Data Breach 
Dear John Sample, 

Brennan Recupero Cascione Scungio and McAllister LLP (“Brennan Recupero”) recently discovered an incident that may 
affect the security of your personal information. We write to provide you with information about the incident, steps taken 
since discovering the incident, and information on what you can do to better protect against the possibility of identity theft 
and fraud. 


What Happened? On August 15, 2016, the credentials for a Brennan Recupero attorney were briefly used by an 
unauthorized individual to remotely access our computer network. The unauthorized access was quickly discovered and 
we immediately reset all user passwords to the network to prevent any further access to the network. In addition, we 
launched an internal investigation and retained third-party forensic experts to determine whether the unauthorized 
individual accessed any data within out network and if so, the extent of that access. 

What Information Was Involved? We determined that while the unauthorized individual or individuals had access to 
Brennan Recupero’s network, certain of your personal information was accessible and may have been viewed by the 
unauthorized individual including your name, Social Security number and address. 

What We Are Doing Brennan Recupero takes the security of your personal information very seriously. While we have 
no evidence your information was specifically impacted or that your information has been misused, we are offering you 
complimentary access to 12 months of free credit monitoring and identity restoration services with AllClear ID. The 
enclosed Steps You Can Take To Protect Against Identity Theft and Fraud contains instructions on how to enroll and 
receive these free services, as well as infonnation on what you can do to better protect against identity theft and fraud. 
We are also notifying certain state regulators of this incident. 


What You Can Do You can enroll to receive the free credit monitoring and identity restoration services. You can also 
review the enclosed Steps You Can Take to Protect Against Identity Theft and Fraud. 


For More Information You can call the call center we have set up for this incident at 1-855-865-6894. The call center 
is available Monday through Saturday, 9:00 a.m. to 9:00 p.m. E.S.T. 


01 - 02 - 4-00 


We take the privacy of your personal information seriously. We sincerely regret any inconvenience or concern this 
incident has caused you. The security of your information is a priority to us and we have taken precautionary measures to 
better prevent something like this from happening again. 


Sincerely, 

"7K. Scuncfia 

Benjamin M. Scungio 


(fa&cime 

Ronald F. Cascione 


Steps You Can Take to Protect Against Identity Theft and Fraud 


As an added precaution, we have arranged to have AllClear ID protect your identity for 12 months at no cost to you. The 
following identity protection services start on the date of this notice and you can use them at any time during the next 12 
months. 


AllClear Identity Repair: This service is automatically available to you with no enrollment required. If a problem arises, 
simply call 1-855-865-6894 and a dedicated investigator will help recover financial losses, restore your credit and make 
sure your identity is returned to its proper condition. 

AllClear Credit Monitoring: This service offers additional layers of protection including credit monitoring and a $1 
million identity theft insurance policy. For a child under 18 years old, AllClear ID ChildScan identifies acts of credit, 
criminal, medical or employment fraud against children by searching thousands of public databases for use of your child’s 
information. To use this service, you will need to provide your personal information to AllClear ID. 

You may sign up online at enroll.allclearid.com or by phone by calling 1-855-865-6894 using the following redemption 
code: Redemption Code. 

Please note: Additional steps may be required by you in order to activate your phone alerts and monitoring options. 

We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and 
to monitor your credit reports for suspicious activity. Under U.S. law you are entitled to one free credit report annually 
from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com 
or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of 
your credit report. 

At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts creditors to take 
additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors 
to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your 
identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. 
Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any 
one of the agencies listed below. 


Equifax 

P.O. Box 105069 
Atlanta, GA 30348 
800-525-6285 
www.equifax.com 


Experian 
P.O. Box 2002 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
800-680-7289 
www.transunion.com 


You may also place a security freeze on your credit reports. A security freeze prohibits a credit bureau from releasing any 
information from a consumer’s credit report without the consumer’s written authorization. However, please be advised 
that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any 
requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of 
identity theft, and you provide the credit bureau with a valid police report, it cannot charge you to place, list or remove a 
security freeze. In all other cases, a credit bureau may charge you a fee to place, temporarily lift, or permanently remove a 
security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed 
above if you wish to place a freeze on all of your credit files. To find out more on how to place a security freeze, you can 
use the following contact information: 


Equifax Security Freeze 

P.O. Box 105788 

Atlanta, GA 30348 

1-800-685-1111 

(NY residents please call 

1-800-349-9960) 

https://www.freeze.equifax.com 


Experian Security Freeze 
P.O. Box 9554 
Allen, TX 75013 
1-888-397-3742 

www.experian.com/freeze/center.html 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
1-888-909-8872 

www.transunion.com/securityfreeze 



ijjqft.v 
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You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by 
contacting the Federal Trade Commission or your state Attorney General. For North Carolina residents, the Attorney 
General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For 
Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, 1- 
888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, 
Washington, DC 20580, www.identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The 
Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint 
with them. Instances of known or suspected identity theft should also be reported to law enforcement. This notice has not 
been delayed by law enforcement. Rhode Island residents: the Attorney General’s office can be contacted at 
http://www.riag.ri.gov/index.php, consumers@riag.ri.gov or (401) 274-4400. There were approximately 1102 Rhode 
Island residents affected by this incident. 


